Verdict Instability of OOD Scores under Reference Resampling

Donghoon Lee; Shinjin Kang

Source-linked AI summary

Verdict Instability of OOD Scores under Reference Resampling

Donghoon Lee, Shinjin Kang

arXiv:2609.00691v1Sep 1, 2026cs.LGstat.ML

TL;DR

Post-hoc OOD scores depend on finite reference sets, but prior evaluation does not measure how verdicts move when that reference data changes. The paper uses bootstrap resampling to derive and test a parameter-free instability measure, finding that score sign and abstention behavior depend on local dispersion, class imbalance, and embedding anisotropy.

Problem
Post-hoc OOD scores are estimates based on finite reference sets, leaving the movement of verdicts under alternative reference draws insufficiently measured.
Method
The paper defines verdict instability as bootstrap score variation under reference-set resampling and derives a closed form based on directional within-class dispersion and reference count.
Results
Wrong-signed scores produce abstention worse than random on every tested dataset, while Eq. (1) tracks bootstrap variance at R2 = 0.82–0.97 across three datasets.
Takeaways & Limitations
Reference-count dependence and embedding anisotropy distinguish verdict reliability from score-distribution geometry, while a single label-free correlation predicts score sign.
Takeaways & Limitations
The sign reverses inside the in-distribution cloud and can be switched off by removing embedding anisotropy.

Abstract

from arXiv · show

Post-hoc out-of-distribution detectors are fitted on a finite reference set, so every score they produce is an estimate. If we had chosen a different set, some verdicts would have moved. We measure that movement by resampling the reference set and recording the bootstrap standard deviation of the score, which we call verdict instability. It admits a closed form with no fitted parameters. The instability of a verdict is the within-class dispersion of the assigned class along the query's direction, divided by the square root of that class's reference count. That count is what separates verdict instability from the geometry of the score distribution, and it is identifiable only under class imbalance. Instability grows with the local dispersion. Far-OOD queries lie along the low-variance directions of an anisotropic embedding, so every distance-based score we test assigns its highest values to the verdicts that are most reproducible. Only estimators of local dispersion carry the sign a practitioner expects. We give a rule that predicts this sign for any score from a single label-free correlation, and abstention driven by a wrong-signed score turns out worse than abstention at random on every dataset we test.

1 Introduction

The paper measures how OOD verdicts change under reference-set resampling and derives a parameter-free instability formula. It links instability’s sign to embedding anisotropy, class imbalance, and whether scores track local dispersion.

Finite reference sets make post-hoc OOD scores estimates whose values can change under a different reference draw.
Bootstrap verdict instability is the score’s standard deviation across resampled reference sets and is epistemic, label-free, and measurable in far-OOD regions.
Instability equals within-class dispersion along the query direction divided by the square root of the assigned class’s reference count, with no fitted parameters.
R2 = 0.82–0.97 across CIFAR-100, CIFAR-10 and DermaMNIST validates Eq. (1)’s bootstrap-variance tracking.
The class count is identifiable only under imbalance: replacing nc by its mean reduces R2 from 0.923 to 0.276, while natural imbalance spans 58.7×.
In anisotropic embeddings, far-OOD queries lie along low-variance directions, so distance scores favor reproducible verdicts while dispersion scores carry the expected sign.
A single label-free correlation predicts any score’s sign, and wrong-signed-score abstention is worse than random abstention across both datasets and ten seeds.

2 Related Work

The paper reframes OOD scores as reference-dependent estimates and distinguishes this uncertainty from query-distribution geometry and predictive uncertainty. It positions reference-set resampling as the missing analysis of score instability.

Post-hoc OOD detectors attach scalar scores to trained networks using classifier heads, logits, or feature spaces without retraining.
Unlike prior geometric analyses that vary queries with a fixed reference set, this paper varies reference sets with the query fixed and obtains Θ(n^-1/2) dependence.
OOD scores can be useful detectors yet harmful uncertainty estimates because detector-output reliability is distinct from predictive uncertainty and correctness.
The corresponding reference-set dependence of OOD scores was missing from prior work, despite bootstrap methods for finite-sample uncertainty being standard.

3 Problem Formulation

The paper formulates OOD verdicts as statistics of a finite reference set and defines verdict instability by bootstrap-resampling that set. This estimator-level quantity is label-free, distinct from correctness, and interpretable through threshold-flip risk.

3.1 Setup: A post-hoc detector is fitted on labeled in-distribution reference subsets, so its score and verdict depend on the finite reference set.The setup includes class centroids, a global centroid, within-class scatter, and a scalar detector score.
3.1 Setup: The analyzed score combines a nearest-class-mean distance with a hinge penalty against a global reference.The class term is estimated from n_c points, while the global term is estimated from N points.
3.2 Verdict instability: Verdict instability T(x) is the score’s standard deviation across class-wise bootstrap reference replicates, quantifying movement under different collected reference data.The bootstrap preserves class counts and uses B = 200 replicates throughout.
3.2 Verdict instability: T decays as n_c^-1/2 and can be translated into the probability that a thresholded verdict reverses under approximately Gaussian resampling.It provides the natural denominator for interpreting a score margin.
3.2 Verdict instability: A query far from the threshold in units of T is safer than one close to it, regardless of its absolute distance from the training data.This makes instability a reliability scale for verdict margins.
3.2 Verdict instability: T requires no labels and is therefore evaluable in far-OOD regions where selective-prediction risk–coverage machinery cannot follow.It is a property of the estimator rather than ground-truth correctness.
3.2 Verdict instability: Instability is neither OOD probability nor predictive uncertainty, and it does not indicate whether a verdict is correct.A confidently wrong detector can remain perfectly stable.
3.2 Verdict instability: The evaluation protocol uses query groups and controls resolution and class counts, with within-group centering for tracked-score correlations.The global abstention analysis instead computes correlations over the pooled query set without centering.

4 Verdict Instability as Projected Within-Class Dispersion

The closed-form instability decomposes into class and global channels, with the class channel governed by directional within-class dispersion and reference count. Experiments show that preserving the count is essential under imbalance, while the fitted-free expression tracks bootstrap instability closely.

4. Verdict Instability as Projected Within-Class Dispersion: The bootstrap approximation predicts instability from plug-in statistics of one reference set, without fitted parameters or tuning against T.The two score terms contribute separate variance channels estimated from different samples.
4.1 The class channel: For a query assigned to class c, centroid perturbations enter the class distance at first order through the query direction u.The derivation uses the query radius and normalized direction from the assigned class centroid.
4.1 The class channel: Transverse dispersion σ_t(u) is the within-class standard deviation projected onto the direction in which the query lies.It is represented by the quadratic form u⊤Σ_cu.
4.1 The class channel: The class channel depends only on the assigned class and varies across directions in anisotropic embeddings, while remaining constant in isotropic ones.Its plug-in form requires neither resampling nor labels.
4.2 The penalty channel: The global penalty is a rectified Gaussian channel whose variance is largest near the hinge elbow and vanishes for queries comfortably outside it.On DermaMNIST, most queries lie outside the hinge and contribute exactly zero penalty variance.
4.3 The two channels: The class and global channels are not strictly independent because the global centroid includes class c, but the covariance is neglected and checked empirically.The resulting expression retains no fitted parameters.
4.4 The reference count: At 58.7× imbalance, replacing n_c by the mean drops R2 from 0.923 to 0.276, showing that the reference count carries substantial explanatory content.At 6.1× imbalance, the corresponding drop is from 0.974 to 0.756.

5 The Sign of a Score

Distance and logit scores are negatively associated with verdict instability because far-OOD queries align with low-variance directions of an anisotropic embedding. A label-free correlation predicts this sign, while class-count dependence is essential under imbalance.

Nine of eleven post-hoc scores are anti-correlated with verdict reliability; only local-dispersion scores carry the expected positive sign.Distance and logit families assign high scores to the most reproducible verdicts.
Far-OOD queries align with low-variance directions, making distance-based scores negatively correlated with transverse dispersion.The allocation effective dimension rises nearly an order of magnitude from in-distribution to far-OOD data while σt falls.
The sign depends on embedding geometry rather than theory: it reverses inside the in-distribution cloud and can be erased by removing anisotropy.Equation (1) remains valid regardless of the sign of ρ(r, σt).
The model predicts any score’s instability sign from sign[ρ(M, bT)], using a plug-in quantity computed from the reference set without bootstrap or labels.The criterion retains the class-count dependence that dispersion-only predictors miss under heavy imbalance.
Mahalanobis stretch and transverse dispersion are reciprocal proxies, so the rule predicts poor abstention from stretch before direct measurement.The inequality W(z)σt(u)^2 ≥ 1 holds for all 3021 queries, with ρ(log W, −log σt^2) = 0.93.

6 The Cost of the Wrong Sign

The paper measures the practical cost of using scores with the wrong instability sign through label-free instability–coverage curves. Wrong-signed abstention is anti-informative, and the sign rule predicts which scores fall worse than random across datasets.

Wrong-signed abstention can leave a retained population whose verdict instability rises as coverage falls, whereas random abstention remains flat.Energy exhibits this anti-informative pattern.
The sign of ρ(M, bT) predicts every score’s side of the random-abstention baseline across both datasets and all ten cells.The narrowest reported margin is energy on CIFAR-100 at +2.15%, with interval [+1.98, +2.31].
The strongest class-channel alignment buys the most stability, while the strongest anti-alignment costs the most, although the paper claims direction rather than exact magnitude.Ranking by ρ(M, bT) reproduces the ranking by ∆ in both datasets, but one adjacent pair is unresolved.
Increasing the reference count shrinks mean instability as n_c^-1/2 but leaves every score on the same side of the baseline.The failure is therefore not attributed to a small-sample artifact.
The failing detector changes with the dataset: energy helps on DermaMNIST, while Mahalanobis carries the failure under imbalance.The sign rule remains correct for every score on both datasets.
OOD detection, classifier correctness, and verdict reproducibility are distinct targets that can be oppositely ordered on real representations.Scores optimized for one target can be beaten by a coin flip on another.

7 Conclusion

The paper frames verdict instability as a measurable property of finite-reference OOD estimators, distinct from correctness and other meanings of uncertainty. Its conclusions depend on preserving natural class imbalance and controlled representation comparisons.

Verdict instability is the within-class dispersion along a query’s direction divided by the square root of its class’s reference count.The closed form has no fitted parameters, and the count is identifiable only under class imbalance.
A single label-free correlation predicts the instability sign, and wrong-signed deferral is worse than random deferral.
The paper distinguishes detector-output reproducibility from predictive uncertainty and correctness: a confidently wrong detector can remain perfectly stable.Instability is defined as a property of the estimator rather than ground-truth correctness.
The evaluation covers CIFAR-100, CIFAR-10, and DermaMNIST with a DINO ViT-B/16 feature extractor and multiple OOD query groups.Correlations are centered within query groups to avoid between-group structure dominating the analysis.
Preprocessing is matched across in-distribution and OOD populations to avoid resolution artifacts confounding representation-based comparisons.For DermaMNIST, OOD images are downsampled to 28 × 28 before feature extraction.
Natural class imbalance is retained because it is the only setting in which the reference-count dependence is identifiable.Majority classes are not subsampled to the minority level.

B Derivation of the Two Channels

The score’s reference-set variability separates into a class channel driven by directional dispersion and count, plus a rectified global penalty channel.

Class channel: The class channel scales with directional dispersion divided by the square root of the class reference count.This follows from the class-conditional bootstrap expansion.
Class channel: For a query assigned to class c, first-order bootstrap perturbations depend only on the centroid displacement along the query direction.The variance uses Var[⟨u, ξ⟩] = u⊤Σcu.
Approximation: The quadratic remainder is O(ϵ2), with tr Σc/nc / r remaining below 0.4% everywhere.The approximation therefore discards a small second-order contribution in the evaluated setting.
Penalty channel: The global penalty channel is a rectified Gaussian formed from the signed activation margin and bootstrap variability of the global distance.Its variance is governed by the hinge’s rectification rather than by the unrectified distance alone.

C Additional Tables

Additional analyses show that imbalance identifies the reference-count contribution, while score families differ in whether they track dispersion or oppose verdict reliability.

Exponent check: The ratio γc = T c√nc/σt,c equals 1 under n_c^-1/2 scaling, but all-query estimates reach 1.77 in the majority class because of penalty contamination.Restricting to penalty-inactive queries removes that contamination.
Exponent check: Holding the observed argmin fixed places the ratio within 0.03 of unity without fitted parameters.Bootstrap changes in the winning centroid explain endpoint movement, with switching from 26% at nc = 80 to 7% at nc = 4693.
Reference count: At 58.7× imbalance, the reference count contributes 0.647 of total R2 = 0.923, or 70%, when substituted for the mean count.All other quantities, including σt(u), remain unchanged in this comparison.
Score families: Nine of eleven post-hoc scores are anti-correlated with verdict reliability; dispersion scores have the expected positive sign, whereas distance and logit families have the negative sign.On CIFAR-100, equal class counts make the plug-in and dispersion rankings closely aligned at ρ = 0.95.
Evaluation: The evaluation uses eleven post-hoc scores, with correlations computed within query groups and odin evaluated at published, untuned settings.Odin’s sign persists across the tested perturbation range, including every ε ≥ 0.001.
Embedding geometry: Conditioning on alignment with leading principal directions changes pooled CIFAR-100 ρ(r, σt) from −0.31 to +0.01 while leaving the metric and σt untouched.This isolates embedding anisotropy as the relevant geometric factor.

H A Representation Check

Re-encoding checks show that the rule and instability relation largely survive changes in representation, while sign behavior follows the new embedding when it changes.

Experimental design: The representation check re-encodes every dataset with an objective-only encoder and a labeled convolutional encoder while keeping crop geometry fixed.Detector hyperparameters, reference sets, query sets, and bootstrap draws are held constant across encodings.
Agreement: Across ten fits, the median T/bT ranges from 0.91 to 0.99 and R2 ranges from 0.66 to 0.97.The original code path reproduces the reference tables on its own embedding.
Agreement: The sign of ρ(M, T) matches the original embedding in 52 of 55 pairs under the first encoding and 54 under the second, with the rule making the same counts.The convolutional encoder agrees with the original backbone everywhere except one pair.
Rule behavior: In the three settings identifying the reference count, the rule calls 65 of 66 pairs correctly.The four differing-sign pairs include correlations near zero, so the predictor has little sign to reverse in those cases.

I The Ablation Behind the Rule

Ablations isolate the reference-count exponent and penalty weight in the sign predictor, then compare Mahalanobis channels for correlation and deferral.

Predictor ablation: The predictor varies only the reference-count exponent α and penalty weight λ because the square root of Eq. (7) preserves rank correlations.The model uses α = 1 and the detector’s own hinge weight.
Predictor ablation: Dropping the reference count at α = 0 loses ten of 55 sign agreements, and no penalty weight recovers them.The maximum is a plateau, so the sign criterion does not sharply identify the exponent or penalty weight.
Channel analysis: The Mahalanobis decomposition evaluates size, stretch, and their product against both the plug-in estimate and instability.The product row corresponds to the full Mahalanobis score.
Channel analysis: All three Mahalanobis channels rank the most reproducible verdicts as the most suspicious, with negative correlations.This is the opposite of the practitioner’s desired stability ranking.
Deferral: Deferring by any Mahalanobis channel is worse than random abstention, with a positive AURC loss in all six cells and all ten seeds.Lower AURC is better, and the sign is unanimous across the evaluation.
Deferral: The stretch channel costs 2.4% on CIFAR-100 versus 3.9% for the size channel it compensates.Controlling stretch improves detection performance while reducing verdict stability.

K Seeds

Across ten seeds, rerunning the protocol moves the overall level but preserves each score’s relative position and the sign of the verdict-instability comparison. The reference-count sweep also preserves score ordering while showing instability decline with sample size, and the two abstention targets favor different scores.

The sign of each score’s relative position is unanimous across ten seeds, with within-score spread an order of magnitude smaller than distance from baseline.
The baseline area matches its predicted value 1/2T to four decimals, while seed variation moves the level by a few percent and carries every score with it.The level correlates at 0.85 or above across all ten cells, while the contrast remains stable.
Every score remains on the same side of the random baseline across reference counts, while mean verdict instability falls with exponent 0.45.Holding the argmin fixed raises the exponent to 0.50.
The sign is claimed only at the tested reference sizes because margins change across the sweep, including energy narrowing from +6.4% to +2.3%.Mahalanobis remains near +4%, while kNN standard deviation remains near −7%.
Abstention targets trade off: MSP performs best for classifier misclassification but second worst for verdict instability, whereas kNN standard deviation reverses those roles.Neither target is presented as universally correct; deployment choice determines which objective is prioritized.